MFH: r496064

Update security/putty to 0.71 security fix release

Unfortunately, this new release breaks GSSAPI_NONE, which is removed
for now. Bug has been reported upstream.

Changelog: https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html

Security:	46e1ece5-48bd-11e9-9c40-080027ac955c

Approved by:	ports-secteam (joneum)

8 files changed, 81 insertions, 30 deletions

diff --git a/security/putty/Makefile b/security/putty/Makefile
index 0fedc2788c81..863885279e01 100644
--- a/security/putty/Makefile
+++ b/security/putty/Makefile
@@ -1,21 +1,22 @@
 # $FreeBSD$
 
 PORTNAME=	putty
-PORTVERSION=	0.70
+PORTVERSION=	0.71
 CATEGORIES=	security ipv6
 MASTER_SITES=	http://the.earth.li/~sgtatham/putty/${PORTVERSION}/ \
 		ftp://ftp.chiark.greenend.org.uk/users/sgtatham/putty-latest/
 
-# Beat Gaetzi (beat@) is permitted to take maintainership back
-# or commit to this port without my prior approval.
 MAINTAINER=	mandree@FreeBSD.org
 COMMENT=	Secure shell and telnet client
+# test plan: test ALL 4 GSSAPI_* options, ALL 3 GTK options, WITH_DEBUG=yes build.
 
 LICENSE=	MIT
 LICENSE_FILE=	${FILESDIR}/LICENSE
 
 USES=		cpe gmake pkgconfig
+
 WRKSRC=		${WRKDIR}/${DISTNAME}/unix
+PATCH_WRKSRC=	${WRKDIR}/${DISTNAME}
 MAKEFILE=	Makefile.gtk
 
 CPE_VENDOR=	simon_tatham
@@ -27,8 +28,10 @@ OPTIONS_RADIO=		TOOLKIT
 OPTIONS_RADIO_TOOLKIT=	GTK2 GTK3
 OPTIONS_DEFAULT=GSSAPI_BASE GTK3
 OPTIONS_SINGLE=	GSSAPI_SELECT
-OPTIONS_SINGLE_GSSAPI_SELECT=	GSSAPI_NONE GSSAPI_BASE GSSAPI_HEIMDAL \
-				GSSAPI_MIT
+#OPTIONS_SINGLE_GSSAPI_SELECT=	GSSAPI_NONE GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT
+# XXX FIXME TODO: GSSAPI_NONE is broken as of PuTTY 0.71 (did work in 0.70).
+# Report has been sent to putty.AT.projects.tartarus.org on 2019-03-17
+OPTIONS_SINGLE_GSSAPI_SELECT=	GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT
 
 CONFLICTS_INSTALL?=	pssh-[0-9]* putty-gtk2-[0-9]* putty-nogtk-[0-9]*
 
@@ -40,10 +43,12 @@ LDFLAGS+=	-Wl,--as-needed
 .if (${PORT_OPTIONS:MGTK2} || ${PORT_OPTIONS:MGTK3}) && !defined(WITHOUT_X11)
 USE_XORG=	x11
 .if ${PORT_OPTIONS:MGTK2}
+USES+=		gnome
 USE_GNOME=	cairo gdkpixbuf2 gtk20
 MAKE_ARGS+=	PUTTY_WITH_GTK=yes GTK_CONFIG="pkg-config gtk+-2.0 x11 --cflags"
 .endif
 .if ${PORT_OPTIONS:MGTK3}
+USES+=		gnome
 USE_GNOME=	cairo gdkpixbuf2 gtk30
 MAKE_ARGS+=	PUTTY_WITH_GTK=yes GTK_CONFIG="pkg-config gtk+-3.0 x11 --cflags"
 .endif
@@ -80,7 +85,9 @@ _COMPAT=		-DNO_GSSAPI
 _COMPAT+=	-DOMIT_UTMP
 
 .if defined(WITH_DEBUG)
+CFLAGS+=	-DDEBUG
 XFLAGS=		-DDEBUG
+_COMPAT+=	-DDEBUG
 .endif
 
 # upstream sets -Werror - there are no issues on 9.1-FreeBSD amd64
diff --git a/security/putty/distinfo b/security/putty/distinfo
index 29f6624e99a5..48336fbb1006 100644
--- a/security/putty/distinfo
+++ b/security/putty/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1500391843
-SHA256 (putty-0.70.tar.gz) = bb8aa49d6e96c5a8e18a057f3150a1695ed99a24eef699e783651d1f24e7b0be
-SIZE (putty-0.70.tar.gz) = 2386108
+TIMESTAMP = 1552820659
+SHA256 (putty-0.71.tar.gz) = 2f931ce2f89780cc8ca7bbed90fcd22c44515d2773f5fa954069e209b48ec6b8
+SIZE (putty-0.71.tar.gz) = 2423752
diff --git a/security/putty/files/patch-settings.c b/security/putty/files/patch-settings.c
new file mode 100644
index 000000000000..5534266f34a2
--- /dev/null
+++ b/security/putty/files/patch-settings.c
@@ -0,0 +1,12 @@
+--- settings.c.orig	2019-03-16 12:26:35 UTC
++++ settings.c
+@@ -990,7 +990,9 @@ void load_open_settings(settings_r *sesskey, Conf *con
+     gprefs(sesskey, "HostKey", "ed25519,ecdsa,rsa,dsa,WARN",
+            hknames, HK_MAX, conf, CONF_ssh_hklist);
+     gppi(sesskey, "RekeyTime", 60, conf, CONF_ssh_rekey_time);
++#ifndef NO_GSSAPI
+     gppi(sesskey, "GssapiRekey", GSS_DEF_REKEY_MINS, conf, CONF_gssapirekey);
++#endif
+     gpps(sesskey, "RekeyBytes", "1G", conf, CONF_ssh_rekey_data);
+     {
+ 	/* SSH-2 only by default */
diff --git a/security/putty/files/patch-sshgssc.c b/security/putty/files/patch-sshgssc.c
new file mode 100644
index 000000000000..824e547c51ea
--- /dev/null
+++ b/security/putty/files/patch-sshgssc.c
@@ -0,0 +1,11 @@
+--- sshgssc.c.orig	2019-03-16 12:26:36 UTC
++++ sshgssc.c
+@@ -75,7 +75,7 @@ static Ssh_gss_stat ssh_gssapi_acquire_cred(struct ssh
+         gssctx->maj_stat =
+             gss->inquire_cred_by_mech(&gssctx->min_stat, cred,
+                                       (gss_OID) GSS_MECH_KRB5,
+-                                      GSS_C_NO_NAME,
++                                      NULL,
+                                       &time_rec,
+                                       NULL,
+                                       NULL);
diff --git a/security/putty/files/patch-Makefile.gtk b/security/putty/files/patch-unix_Makefile.gtk
index 639625c0b892..ddd99e19d6dd 100644
--- a/security/putty/files/patch-Makefile.gtk
+++ b/security/putty/files/patch-unix_Makefile.gtk
@@ -1,28 +1,49 @@
---- Makefile.gtk.orig	2017-04-24 13:52:46 UTC
-+++ Makefile.gtk
-@@ -111,7 +111,7 @@ GTK_CONFIG = sh -c 'pkg-config gtk+-3.0 
+--- unix/Makefile.gtk.orig	2019-03-16 12:26:40 UTC
++++ unix/Makefile.gtk
+@@ -109,7 +109,7 @@ GTK_CONFIG = sh -c 'pkg-config gtk+-3.0 x11 $$0 2>/dev
  
  unexport CFLAGS # work around a weird issue with krb5-config
  
--CFLAGS = -O2 -Wall -Werror -g -I.././ -I../charset/ -I../windows/ -I../unix/ \
-+CFLAGS := $(CFLAGS) -Wall -Werror -I.././ -I../charset/ -I../windows/ -I../unix/ \
- 		$(shell $(GTK_CONFIG) --cflags) -D _FILE_OFFSET_BITS=64
+-CFLAGS = -O2 -Wall -Werror -std=gnu99 -Wvla -g -I.././ -I../charset/ \
++CFLAGS := $(CFLAGS) -Wall -Werror -std=gnu99 -Wvla -I.././ -I../charset/ \
+ 		-I../windows/ -I../unix/ $(shell $(GTK_CONFIG) --cflags) -D _FILE_OFFSET_BITS=64
  XLDFLAGS = $(LDFLAGS) $(shell $(GTK_CONFIG) --libs)
  ULDFLAGS = $(LDFLAGS)
-@@ -138,8 +138,12 @@ man1dir=$(mandir)/man1
+@@ -136,8 +136,13 @@ man1dir=$(mandir)/man1
  .SUFFIXES:
  
  
 +ifdef PUTTY_WITH_GTK
  all: cgtest fuzzterm osxlaunch pageant plink pscp psftp pterm ptermapp putty \
- 		puttyapp puttygen puttytel testbn
+ 		puttyapp puttygen puttytel testcrypt testsc testzlib uppity
 +else
-+all: plink pscp psftp puttygen
++all: cgtest fuzzterm osxlaunch plink pscp psftp \
++		puttygen testcrypt testsc testzlib uppity
 +endif
  
- cgtest: cgtest.o conf.o import.o misc.o notiming.o sshaes.o sshbcrypt.o \
- 		sshblowf.o sshbn.o sshdes.o sshdss.o sshdssg.o sshecc.o \
-@@ -1047,10 +1051,12 @@ xpmputty.o: ../unix/xpmputty.c
+ cgtest: cgtest.o conf.o ecc.o import.o marshal.o memory.o misc.o mpint.o \
+ 		notiming.o sshaes.o sshauxcrypt.o sshbcrypt.o sshblowf.o \
+@@ -497,15 +502,15 @@ testsc: ecc.o marshal.o memory.o mpint.o sshaes.o ssha
+ 		sshblowf.o sshccp.o sshcrc.o sshcrcda.o sshdes.o sshdh.o \
+ 		sshdss.o sshecc.o sshhmac.o sshmac.o sshmd5.o sshrsa.o \
+ 		sshsh256.o sshsh512.o sshsha.o testsc.o tree234.o utils.o \
+-		uxutils.o wildcard.o
++		uxutils.o wildcard.o uxmisc.o
+ 	$(CC) -o $@ ecc.o marshal.o memory.o mpint.o sshaes.o ssharcf.o \
+ 		sshauxcrypt.o sshblowf.o sshccp.o sshcrc.o sshcrcda.o \
+ 		sshdes.o sshdh.o sshdss.o sshecc.o sshhmac.o sshmac.o \
+ 		sshmd5.o sshrsa.o sshsh256.o sshsh512.o sshsha.o testsc.o \
+-		tree234.o utils.o uxutils.o wildcard.o $(ULDFLAGS) 
++		tree234.o utils.o uxutils.o wildcard.o uxmisc.o $(ULDFLAGS) 
+ 
+-testzlib: marshal.o memory.o sshzlib.o testzlib.o utils.o
+-	$(CC) -o $@ marshal.o memory.o sshzlib.o testzlib.o utils.o \
++testzlib: marshal.o memory.o sshzlib.o testzlib.o utils.o uxmisc.o
++	$(CC) -o $@ marshal.o memory.o sshzlib.o testzlib.o utils.o uxmisc.o \
+ 		$(ULDFLAGS) 
+ 
+ uppity: be_misc.o be_none.o callback.o conf.o cproxy.o ecc.o errsock.o \
+@@ -1602,10 +1607,12 @@ xpmputty.o: ../unix/xpmputty.c
  
  install:
  	mkdir -p $(DESTDIR)$(bindir) $(DESTDIR)$(man1dir)
@@ -36,7 +57,7 @@
  	$(INSTALL_PROGRAM) -m 755 pterm $(DESTDIR)$(bindir)/pterm
  	if test -n "$(UTMP_GROUP)"; then \
  	  chgrp $(UTMP_GROUP) $(DESTDIR)$(bindir)/pterm && \
-@@ -1060,16 +1066,18 @@ install:
+@@ -1615,16 +1622,18 @@ install:
  	    chmod 4755 $(DESTDIR)$(bindir)/pterm; \
  	fi
  	$(INSTALL_PROGRAM) -m 755 putty $(DESTDIR)$(bindir)/putty
diff --git a/security/putty/files/patch-uxnet.c b/security/putty/files/patch-unix_uxnet.c
index 78e618506aaf..5b49ab4de5a1 100644
--- a/security/putty/files/patch-uxnet.c
+++ b/security/putty/files/patch-unix_uxnet.c
@@ -1,14 +1,14 @@
---- ./uxnet.c.orig	2009-08-07 00:55:15.000000000 +0200
-+++ ./uxnet.c	2011-07-17 14:55:44.000000000 +0200
+--- unix/uxnet.c.orig	2019-03-16 12:26:37 UTC
++++ unix/uxnet.c
 @@ -11,8 +11,13 @@
  #include <sys/types.h>
  #include <sys/socket.h>
  #include <sys/ioctl.h>
 +#ifdef __FreeBSD__
 +#include <netinet/in.h>
-+#include <arpa/inet.h>
-+#else
  #include <arpa/inet.h>
++#else
++#include <arpa/inet.h>
  #include <netinet/in.h>
 +#endif
  #include <netinet/tcp.h>
diff --git a/security/putty/files/patch-unix__uxpgnt.c b/security/putty/files/patch-unix_uxpgnt.c
index 3ef98d5849fa..bd12c993c2e8 100644
--- a/security/putty/files/patch-unix__uxpgnt.c
+++ b/security/putty/files/patch-unix_uxpgnt.c
@@ -1,6 +1,6 @@
---- uxpgnt.c.orig	2017-03-16 03:33:18.000000000 +0000
-+++ uxpgnt.c	2017-03-16 03:33:18.000000000 +0000
-@@ -270,7 +270,7 @@
+--- unix/uxpgnt.c.orig	2019-03-16 12:26:38 UTC
++++ unix/uxpgnt.c
+@@ -241,7 +241,7 @@ void pageant_fork_and_print_env(bool retain_tty)
          /* Get out of our previous process group, to avoid being
           * blasted by passing signals. But keep our controlling tty,
           * so we can keep checking to see if we still have one. */
diff --git a/security/putty/files/patch-uxpty.c b/security/putty/files/patch-unix_uxpty.c
index c3ceee0949a7..bd56447ced52 100644
--- a/security/putty/files/patch-uxpty.c
+++ b/security/putty/files/patch-unix_uxpty.c
@@ -1,5 +1,5 @@
---- ./uxpty.c.orig	2011-03-02 20:12:42.000000000 +0100
-+++ ./uxpty.c	2011-07-17 14:55:44.000000000 +0200
+--- unix/uxpty.c.orig	2019-03-16 12:26:38 UTC
++++ unix/uxpty.c
 @@ -13,7 +13,6 @@
  #include <fcntl.h>
  #include <termios.h>